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University at Buffalo 

Clinical Legal Education 

School of Law 
%ptember 22. 2018 

Freedom of Information Act Appeal re: Expedited Processing 

Treasury Inspector General for Tax Administration 

Office of Chief Counsel 

City Center Building 

1401 H Street. NW. Suite 46^ 

Washington. D.C. 20005 

RE: Appeal of Expedited Processing 
Disclosure File #2018-FOI-00260 

Dear Sir or Madam: 

We write on behalf of the co-requestors Privacy International (“PI”), the American 
"ivil Liberties Union, and the American Civil Liberties Union Foundation ftogether, the 
“ACLU”), and the Civil Liberties and Transparency Clinic of the University at Buffalo 
School of Law (“CLTC”), to appeal your agency’s September 12, 2018, decision denying 
expedited processing of our September 10, 2018, Freedom of Information Act (“FOIA”) 
request. 


1. Background 

By letter dated September 10,2018, PI, ACLU, and CLTC requested from the 
Treasury Department’s Office of the Inspector General (“OIG”) and its affiliate, the 
Treasury Inspector General for Tax Administration (“TIGTA”), copies of records related to 
investigations or audits into the use of computer hacking tools by law enforcement agents. 
The FOIA request (attached hereto as Exhibit A) sought two categories of records and asked 
for expedited processing under 5 U.S.C. § 552(a)(6)(E). 

As of today, we have received one letter in response to our request to TIGTA. This 
letter from Disclosure Officer Monica Frye, dated September 12, 2018, acknowledged 
receipt of our request and denied expedited processing (attached as Exhibit B). We have 
received no documents from your agency responsive to our request, nor has TIGTA cited 
any FOIA exemptions as a basis for refusing to disclose records.' Interestingly, we received 
a response to our request from the Treasury Department on September 14, 2018, that 
granted expedited processing of records from the Treasury OIG, in direct conflict with 
TIGTA’s denial (attached as Exhibit C). 


‘ This appeal is timely filed within 10 days of receipt of Ms. Frye’s letter denying our request for 
expedited processing. We received that letter on September 12, 2018. 
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II. Basis for Appeal 

Pursuant to Treasury Department FOIA regulations, 31 C.F.R. § 1.5(e)(5), we hereby 
timely appeal TIGTA’s refusal to grant expedited proeessing. TIGTA’s denial letter cites 
two regulatory criteria as the basis for denying expedited processing: (1) the requirement to 
show a “compelling need,” and (2) the requirement that a statement showing compelling 
need must be certified to be true and correct “according to the form prescribed by 28 U.S.C. 
§ 1746.” The letter states without elaboration that expedited processing is being denied 
“[bjased on these regulatory criteria,” but it does not offer any explanation as to why the 
request fails to meet them. As demonstrated presently, neither of these bases for denial have 
merit. 


A. Requestors have demonstrated a “compelling need” 

PI, the ACLU and CLTC’s detailed FOIA request amply demonstrates that there is a 
compelling need for disclosure of the information requested. FOIA requires expedited 
processing of requests when a “compelling need” for the information exists. 5 U.S.C. § 
552(a)(6)(E). The Department of the Treasury’s regulations elaborate that a “compelling 
need” exists when there is an “urgency to inform the public concerning actual or alleged 
Federal Government activity” so long as the request is made by a person “primarily engaged 
in disseminating information.” 31 C.F.R. § 1.5(e)(2)(ii). The regulations further specify that 
the “standard of ‘urgency to inform’ requires that records pertain to a matter of current 
exigency to the American public” and “that delaying a response to a request for records 
would compromise a significant recognized interest to and throughout the American general 
public.” Id. The requester is required to “adequately explain the matter or activity and why 
the records sought are necessary to be provided on an expedited basis.” Id. 

PI, ACLU, and CLTC’s request satisfies the criteria specified in the statute and 
Treasury regulations. The request demonstrates that these there is an “urgency to inform the 
public” concerning government hacking technologies and, in particular, any TIGTA 
investigations or audits of government hacking techniques. The request elaborates in great 
detail on the “matter or activity” in question and “why the records sought are necessary to 
be provided on an expedited basis.” Id. Indeed, the request includes more than eight pages 
of information about law enforcement agencies’ deployment of hacking and related social 
engineering techniques to access and gather information on computer systems. See Ex. A, at 
1-8,16-17. These explanations are supported by numerous footnoted citations to sources 
and authority. Id. 

Moreover, the request demonstrates that the government’s use and misuse of hacking 
technology is “a matter of current exigency to the American public.” 31 C.F.R. § 

1.5(e)(2)(ii). The request cites to numerous newspaper articles, NGO reports, and other 
sources (including an OIG report from another law enforcement agency) from the past year 
or two that concern government hacking. See Ex. A, at notes 3-21, 34-36, 43, 55-56 and 
accompanying text. These sources demonstrate, individually and collectively, that there is 
an immediate, current, and ongoing public interest in this topic “throughout the American 
general public.” 31 C.F.R. § 1.5(e)(2)(ii). Failure to obtain prompt disclosure would 
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“compromise a significant recognized interest” of the general public in understanding how 
the government is using—^and whether the government is misusing—^this new and 
extraordinarily intrusive investigative technology. 

The request elaborates specific reasons why this subject matter is of current 
exigency to the American public. The request shows, for example, that these techniques are 
proliferating rapidly, particularly now that they are available commercially to law 
enforcement agencies. As the request explains. Privacy International has identified over 500 
surveillance technology companies that sell products and services exclusively to 
government clients for law enforcement and intelligence-gathering purposes,^ including 
tools to enable hacking. Moreover, numerous breaking news stories have recently been 
published on the government’s use of hacking tools. See Ex A, at 16 & n.55. At least one of 
these breaking news stories resulted in an OIG investigation that itself was the subject of 
considerable media interst. See id. at 16 n. 56. 

The public thus has an exigent need for information about the kinds of hacking that 
the government is engaged in and, especially, whether TIGTA and other offices of inspector 
general have investigated for instances of waste, fraud, abuse, illegality, or other problems 
with respect to such techniques. This information is critical to inform the ongoing and 
urgent public debate about the wisdom and legality of these methods, and to inform the 
public about whether the public’s constitutional and statutory privacy interests are being 
respected. 

PI, the ACLU, and CLTC also satisfy the other prong of the applicable test for a 
“compelling need” because they are “primarily engaged in disseminating information” 
within the meaning of the statute and regulation. 5 U.S.C. § 552(a)(6)(E)(v)(II); 31 C.F.R. § 
1.5(e)(2)(ii). The request provides more than five pages of evidence to establish this point. 
See Ex. A. at 10-16. To summarize briefly, PI engages in research and litigation specifically 
in order to shine light on overreaching state and corporate surveillance. PI achieves this goal 
primarily by disseminating information it gathers to the public by publishing reports, 
websites, blog posts, and several other types of material meant for general public 
consumption. See Ex. A, at 10-11 & nn. 29-36. Similarly, the ACLU works to defend and 
preserve the individual rights and liberties guaranteed by the Constitution and laws of the 
United States by gathering and disseminating information. Indeed, obtaining information 
about government activity, analyzing that information, and widely publishing and 
disseminating that information to the press and public are critical and substantial 
components of the ACLU’s work and are among its primary activities. See Ex. A, at 11-14 
& nn. 37-49. Finally, CLTC is a legal clinic that works in its own name and on behalf of 
clients to obtain and disseminate information on issues involving technology & privacy and 
law enforcement accountability, among others. See Ex. A., at 15 & nn. 50-53. There is thus 
no doubt that the requesters satisfy the requirement of being “primarily engaged in 
disseminating information.”^ 


^ Privacy International, Privacy International Launches the Surveillance Industry Index & New 
Accompanying Report, Oct. 23, 2017, https://www.privacyintemational.org/blog/54/privacy-intemational- 
launches-surveillance-industry-index-new-accompanying-report (last visited July 18,2018). 

- Only one of the requestors needs to qualify in order for expedited processing to be required. See 


3 




Case l:18-cv-01488 Document 1-27 Filed 12/21/18 Page 5 of 8 


For these reasons, there is a “compelling need” that justifies expedited processing, 
and TIGTA’s denial should be reversed. 

B. Requestors satisfied FOIA’s requirement to provide a certification in 

su pport of expedited processing. 

TIGTA appears to have denied expedited processing in part because the request did 
not contain a certification as to the truth of requestor’s statements demonstrating a 
compelling need. See Ex. B. at 1. This ground for denial fails because the request did in fact 
contain the certification required by FOIA. See Ex. A, at 17. In particular, FOIA states that 
a requestor’s “demonstration of compelling need” must “be made by a statement certified by 
such person to be true and correct to the best of such person’s knowledge.” 5 U.S.C. § 
552(a)(6)(E)(vi). The request at issue in this appeal contained precisely that certification, 
stating, “The undersigned certify, pursuant to 5 U.S.C. § 552(a)(6)(E)(vi), that the 
information provided is true and correct to the best of their knowledge and belief.” See Ex. 
A. at 17. 

It appears that TIGTA’s denial may be premised on the theory that the certification 
did not contain the precise words that the Treasury Department has sought to require by 
regulation. Specifically, the Treasury Department’s regulations provide: 

A demonstration of a compelling need by a person making a request for 
expedited processing shall be made by a statement certified by the requester 
to be true and correct to the best of his or her knowledge and belief The 
statement must be in the form prescribed by 28 U.S.C. 1746. “I declare under 
penalty of perjury that the foregoing is true and correct to the best of my 
knowledge and belief Executed on [date].” [31 C.F.R. § 1.5(e)(3).] 

This basis for denial fails for a number of reasons. First, the certification that is 
included in the request is, in substance and effect, indistinguishable from the one that the 
Treasury regulation purports to require. The request certified that the requestors were telling 
the truth, to the best of their knowledge and belief. In this regard, it is worth noting again 
that the Treasury Department has granted the requestors expedited processing with respect 
to their separate request for records from the Treasury OIG. This strongly suggests that the 
Department itself does not believe it can insist on the specific wording found in the 
regulation where a requester has included the specific wording prescribed by the statute. 

Second, to the extent that the Treasury regulation purports to require the certification 
to be in the specific form of an unsworn affidavit, as prescribed by 28 U.S.C. § 1746, the 
regulations are in conflict with FOIA and are invalid. The Treasury Department cannot 
impose additional and idiosyncratic requirements on FOIA requestors that conflict with the 
plain terms of the statute. See Al-Fayed v. CIA, 254 F.3d 300, 307 (D.C. Cir. 2001); 


ACLUv. DOJ, 321 F. Supp. 2d at 30 n. 5 (citing Al-Fayed v. CIA, 254 F.3d 300, 309 (D.C. Cir. 2001) 
(“[A]s long as one of the plaintiffs qualifies as an entity ‘primarily engaged in disseminating information,’ this 
requirement is satisfied.”). 
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Gonzales and Gonzales Bonds and Ins. Agency v. U.S. Dep ’t of Homeland Security, 913 F. 
Supp. 2d 865 (N.D. Cal. 2012). 

FOIA clearly and explicitly requires only a “statement certified by such person to be 
true and correct to the best of such person’s knowledge and belief.” It explicitly does not 
require the statement to be “sworn” or otherwise to be made under penalty of perjury. It 
certainly does not require the precise form of words found in 28 U.S.C. §1746. 

To the contrary, the text of FOIA evidences a congressional intent not to require 
statements to be made under penalty of peijury or in the form of an unsworn declaration 
pursuant to 28 U.S.C. § 1746. FOIA requires the requester only to certify that his or her 
statements are true “to the best of such person’s knowledge and belief” There is of course a 
crucial difference between statements made “to the best of one’s knowledge and belief’ and 
statements made upon personal knowledge. Only the latter are typically the subject of 
sworn testimony or affidavits under penalty of perjury. By using the language it did, 
Congress indicated its clear intent not to require personal knowledge of the facts, but instead 
only a belief that the facts are true. It therefore contradicts Congress’ intent to require FOIA 
requesters to make the required statement under penalty of peijury pursuant to 28 U.S.C. § 
1746. 


Treasury’s effort to incorporate a “penalty of perjury” requirement—and to require 
that a specific form of words be used in the certification—^thus contradicts the plain text of 
FOIA and is invalid. See Al-Fayed, 254 F.3d at 307 (“[Where a] term is defined by FOIA 
itself, and because the definition applies across the government, district courts may not defer 
to any individual agency’s effort to elaborate upon that definition—^whether through case- 
specific determinations or through regulations”); Pub. Citizen Health Research Group v. 
FDA, 704 F.2d 1280, 1287 (D.C. Cir. 1983) (declining to defer to a regulation defining a 
provision of FOIA, because doing so “would produce an intolerable situation in which 
different agencies could adopt inconsistent interpretations of the FOIA”). 

In short, the requestors here precisely complied with the certification requirements of 
the FOIA statute. Treasury cannot deny requestors’ their statutory right to expedited 
processing based on a supposed failure to use specific wording not required or contemplated 
by the statute. 

Nevertheless, without conceding the lawfulness of Treasury’s regulation and in order 
to avoid an improper denial of expedited processing on the basis of a technicality, requesters 
are happy to cure the supposed defect in their original request. We therefore make the 
certification here with respect to the original request in the form set out by the Treasury 
regulations and 28 U.S.C. § 1746: 
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I declare under penalty of perjury that the statement 
offered to demonstrate compelling need, attached 
hereto as Exhibit A, is true and correct to the best of my 
knowledge and belief. Executed on September 21, 


2018. 


Jonathan Manes 


III. Request for Relief 

For the foregoing reasons, we submit that PI, the ACLU, and CLTC are entitled to 
expedited processing. We respectfully request that you grant expedited processing and 
immediately begin processing the requested records for potential release. 

We trust that we will receive your decision within 10 business days as required by 31 
C.F.R. § 1.5(e)(6). Please direct all correspondence relating to this request to: 

Jonathan Manes 

Civil Liberties & Transparency Clinic 
University at Buffalo School of Law 
507 O’Brian Hall, North Campus 
Buffalo, NY 14260-1100 
(716) 645-6222 
immanes@,buffalo.edu 

Thank you for your prompt attention to this matter. 


Sincerely. 


Brett Max Kaufman 
Vera Eidelman 

American Civil Liberties Union 
Foundation 

125 Broad Street, 18th Floor 
New York, NY 10004 
bkaufman@aclu.org 
veidelman@aclu.org 



Alex Betschen, student attorney 
RJ McDonald, student attorney 
Colton Kells, student attorney 
Civil Liberties and Transparency Clinic 
University at Buffalo School of Law, SUNY 
507 O’Brian Hall, North Campus 
Buffalo, NY 14260-1100 
Tel: 716.645.6222 


jnimanes@buffalo.edu 


6 








Case l:18-cv-01488 Document 1-27 Filed 12/21/18 Page 8 of 8 


Jennifer Stisa Granick 

American Civil Liberties Union 

Foundation 

39 Dmmm Street 

San Francisco, CA 94111 

Tel: 415.343.0758 

j granick@aclu.org 


Scarlet Kim 

Privacy International 

62 Britton Street 

London ECIM 5UY 

United Kingdom 

Tel: +44 (0)203 422 4321 

scarlet@privacyintemational.org 
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